"Allow log on through Remote Desktop Services" user right has no effect

According to the Microsoft documentation:

To use Remote Desktop Services to successfully log on to a remote device, the user or group must be a member of the Remote Desktop Users or Administrators group and [emphasis added] be granted the Allow log on through Remote Desktop Services right.

Since the Remote Desktop Users group is granted the Allow log on through Remote Desktop Services right, adding a user or group to that group fulfills both requirements, while simply granting the right does not.

As to why both are required, I don't know.

Note that the same page specifies that the recommended best practice is:

To control who can open a Remote Desktop Services connection and log on to the device, add users to or remove users from the Remote Desktop Users group.


Permission to establish a remote desktop session and permission to log in when using a remote desktop session are two different things. The user rights assignment settings only affect the latter.

Microsoft do provide documentation on changing the permissions that control who can establish a remote desktop session:

  • How to add a user to Terminal Services RDP permissions by using WMI

  • How to modify or query the RDP connection permissions for Terminal Services

However, I strongly recommend that you don't mess with these settings. As Todd's answer already mentioned, adding domain users and/or groups to the Remote Desktop Users local group is the supported method for granting remote desktop access.

(Incidentally, you also need the "Access this computer from the network" right in order to establish a connection.)